Three-intensity decoy state method for device independent 
quantum key distribution with basis dependent errors 

Xiang-Bin Wang 1,2 '0 

1 Department of Physics, Tsinghua University, Beijing 100084, China 
2 Jinan Institute of Quantum Technology, 
Shandong Academy of Information Technology, Jinan, China 

Abstract 

We study the measurement device independent quantum key distribution (MDIQKD) in practice 
with limited resource, when there are only 3 different states in implementing the decoy-state method 
and when there are basis dependent coding errors. We present general formulas for the decoy-state 
method for two-pulse sources with 3 different states, which can be applied to the recently proposed 
MDIQKD with imperfect single-photon source such as the coherent states or the heralded states 
from the parametric down conversion. We point out that the existing result for secure MDIQKD 
with source coding errors does not always hold. We find that very accurate source coding is not 
necessary. In particular, we loosen the precision of existing result by several magnitude orders for 
secure QKD and MDIQKD. 
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I. INTRODUCTION 

Security for real set-ups of quantum key distribution(QKD) has become a major 
problem in the area in the recent years. The major problems here include the imperfection 



of source and the limited efficiency of the detection device. The decoy state method 
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can help to make a set-up with an imperfect single photon source be as secure as that with 
a perfect single photon source ljj Q . 

Besides the source imperfection, the limited detection is another threaten to the 



security 



15|. Theories of the device independent security proof [l6| have been proposed to 



overcome the problem. However, these theories cannot apply to the existing real set-ups 
because violation of Bell's inequality cannot be strictly demonstrated by existing set-ups. 

Very recently, an idea of measurement device independent QKD (MDIQKD) was proposed 
based on the idea of entanglement swapping 17J, ll8( . There, one can make secure QKD 
simply by virtual entanglement swapping, i.e., Both Alice and Bob sends BB84 states to the 
relay which can be controlled by un-trusted third party (UTB). After the UTB announced 
his measurement outcome, Alice and Bob will post select those bits corresponding to a 
successful event and prepared in the same basis for further processing. In the realization, 
Alice and Bob can really use entanglement pairs [17] and measure halves of the pair inside 
the lab before sending another halves to the UTB. In this way, the decoy-state method is 
not necessary even though imperfect entangled pairs (such as the states generated by the 
type II parametric down conversion) are used. Even though there are multi-pair events with 
small probability, these events do not affect the security. Alice and Bob only need to check 
the error rates of their post selected bits. However, in our existing technologies, high quality 
entangled-pair-state generation can not be done efficiently In the most matured technology, 
the generation rate is lower than 1 from 1000 pump pulses. If we want to obtain a higher key 
rate, we can choose to directly use an imperfect single-photon source such as the coherent 
state 18j. If we choose this, we must be careful for two issues. First, we must implement the 
decoy-state method for security. Although this has been discussed in Ref.[18], calculation 
formulas for the practical decoy-state implementation with only a few different states are 
not given. Second, in this way, the states for coding are prepared actively. If we cannot 
guarantee to make exactly the BB84 states, we must take special caution for the security. 
Although there are already some results for this 19j, there are some drawbacks in practical 
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application of the existing result [191] . First, it requests a very accurate source coding, e.g., a 
magnitude order of 10~ 7 for the state errors for MDIQKD over a distance longer than 100 
kms. Second, the existing conclusion seem to be not always correct. The existing theory [lj]] 
shows that the source coding error affects the key rate only through the fidelity between the 
density matrices of two bases. According to its conclusion, if the density operators of states 
in the two bases are identical, then one can calculate the key rate as if an ideal realization of 
MDIQKD were done. In such a case, the key rate is determined solely by the detected error 
rate. Consider such a special case: in the protocol, Alice and Bob can produce the perfect 
BB84 states in Z basis, |0 2 ) and but they make big errors in preparing states in X 
basis. They actually prepared |0 2 ) or \l z ) whenever they wantto prepare states |0 X ) or 
Given this fact, Eve. or the UTB can simply measure each pulses in Z basis without causing 
any additional noise. Therefore, correct theory should give key rate for this. However, 
the existing theory can result in considerable key rate for this case because in principle one 
can obtain lots of post selected successful events with small error rate in MDIQKD. Such 
a problem also exists in the MDIQKD protocol with entangled-pair states[l7]]. Although 
the states out of the labs are identical for whatever basis, the measurement basis alignment 
error in detecting the halves of the pair states inside each labs can undermine the security. 
In an extreme example, they make measurement in Z basis perfectly. But when they want 
to use X basis, they actually used Z basis. Normally, users are not likely to make such big 
mistakes, however, the existing theory seemed to even allow these mistakes. 

Here in this work, we shall first present formulas of 3-state decoy-state method for the 
MDIQKD. We then study the problem source coding error. Our result presented here does 
not request very accurate source coding as the existing ones which requests a magnitude 
order of 10~ 7 for the state errors, while our request for the accuracy is more loosen than this 
by several magnitude orders. Based on the idea of constructing virtual BB84 sources, our 
result is strict for security. 



II. DECOY-STATE METHOD WITH ONLY 3 STATES FOR MDIQKD 

In the protocol, each time a pulse-pair (two-pulse state) is sent to the relay for detection. 
The relay is controlled by an un-trusted thirty party (UTP). The UTP will announce whether 
the pulse-pair has caused a successful event. Those bits corresponding to successful events 



3 



will be post-selected and further processed for the final key. Since real set-ups only use 
imperfect single-photon sources, we need the decoy-state method security. 

We assume Alice (Bob) has three sources, oa,xa,Ua (ob,x b ,i/ b ) which can only emit 
three different states p OA = |0)(0|, p XA , p yA (p OB = |0)(0|, p XB , p yB ), respectively, in photon 
number space. Suppose 

Pxa = ^a k \k)(k\; p yA = J2 a k\ k )i k \,Px B = J2 b k\k){k\; Py B = XXl^l' ( X ) 

k k k k 

and we request the states satisfy the following very important condition: 

ak ~ a 2 ' ' b k ~ b 2 

for k > 2. The imperfect sources used in practice such as the coherent state source, the 
heralded source out of the parametric-down conversion, satisfy the above restriction. Given 
a specific type of source, the above listed different states have different averaged photon 
numbers (intensities), therefore the states can be obtained by controlling the light intensities. 
At each time, Alice will random select one of her 3 sources to emit a pulse, and so does 
Bob. The pulse form Alice and the pulse from Bob form a pulse pair and are sent to the 
un-trusted relay. We regard equivalently that each time a two-pulse source is selected and a 
pulse pair (one pulse from Alice, one pulse from Bob) is emitted. There are many different 
two-pulse sources used in the protocol. We denote af3 for the two pulse source when the 
pulse-pair is produced by source a at Alice's side and source j3 at Bob's side, a can be one 
of {oa,xa,Va} and /3 can be one of {ob, xb, Ub}- For example, at a certain time Alice uses 
source oa and Bob uses source i/b, we say the pulse pair is emitted by source oaVb- 

In the protocol, two different bases, Z basis consisting of horizontal polarization \H)(H\ 
and vertical polarization |V)(V|, and X basis consisting of 7r/4 and 3n/A polarizations are 
used. The density operator in photon number space alone does not describe the state in the 
composite space. We shall apply the the decoy-state method analysis in the same basis (e.g., 
Z basis or X basis) for pulses from sources XA,XB,yA,VB- Therefore we only need consider 
the density operators in the photon number space. For simplicity, we consider pulses from 
source prepared in Z basis first. 

According to the decoy-state theory, the yield of a certain set of pulse pairs is defined as 
source a/3 is defined as the happening rate of a successful event (announced by the UTP) 
corresponding to pulse pairs out of the set. Mathematically, the yield is n/N where n is the 

4 



(2) 



number of successful events happened corresponding to pulse pairs from the set and N is 
the number of pulse pairs in the set. Obviously, if we regard the pulse pairs of two-pulse 
source a (3 as a set, the yield S a s for source a (3 is S a a = 5^-, where n a s is the number 
of successful events happened corresponding to pulse pairs from source a/3 and N a p is the 
number of times source a (5 are used. In the protocol, there are 9 different two-pulse sources. 
The yields of these 9 sources can be directly calculated from the observed experimental data 
n a/ 3 and N a/3 . We use capital letter S a p for these known values. 

We can regard any source as a composite source that consists of many (virtual) sub- 
sources, if the source state can be be written in a convex form of different density operators. 
For example, two-pulse source uaUb includes a sub-source of pulse pairs of state p\ <g> pi 
(pi = |1)(1|) with weight a'^. This is to say, after we have used source UaUb for N times, 
we have actually used sub-source of state pi <g> pi for a'^N times, asymptotically. Similarly, 
the source xa%b also includes a sub-source of state {p 1 <g> p{\ with weight ai&i. These two 
sub-sources of state pi <S> pi must have the same yield su because they have the same two- 
pulse state and the pulse pairs are randomly mixed. Most generally, denote s, s' as the yields 
of two sets of pulses, if pulse pairs of these two sets are randomly mixed and all pulses have 
the same density operator, then 

s = s' (3) 

asymptotically. This is the elementary assumption of the decoy-state theory. 

In the protocol, since each sources are randomly chosen, pulses from each sub-sources 
or sources are also randomly mixed. Therefore, the yield of a sub-source or a source is 
dependent on the state only, it is independent of which physical source the pulses are from. 
Therefore, we can also define the yield of a certain state: whenever a pulse pair of that state 
is emitted, the probability that a successful event happens. Denote 

tt a (3 = p a ® P/3 (4) 

for a two-pulse state. The yield of such a state is also the yield of any source which produces 
state Q a p only, or the yield of a sub-source from any source, provided that the state of the 
pulse pairs of the sub-source is VL a p- Note that, we don't always know the value of yield of 
a state. Because we don't know which sub-source was used at which time. We shall use the 
lower case symbol s a ^ to denote the yield of state fl a ^. In general, the yields of a sub-source 
(a state), such as s n not directly known from the experimental data. But some of them can 
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be deduced from the yields of different real sources. According to Eq.([3]), if a G {0,xa,Va} 
and j3 e {0, xb, Vb}, we have 

Sa/3 = S & fi (5) 

with the mapping of a = (oaiXaiUa) for a = (0, xa, Va), respectively; and (3 = (ob,xb,Vb) 
for (3 = (0, xb, Vb), respectively. To understand the meaning of the equation above, we take 
an example for pulses from source UaVb- By writing the state of this source in the convex 
form we immediately know that it includes a sub-source of state p £g> p VB . By observing 
the results caused by source z/aVb itself we have no way to know the yield of this sub- 
source because we don't know exactly which time source jja emits a vacuum pulse when we 
use it. However, the state of this sub-source is the same with the state of the real source 
oaUbi therefore the yield of any sub-source of state p®p VB must be just the yield of the real 
source oaVb, which can be directly observed in the experimental. Mathematically, this is 
Sq Vb = S OAVB , where the right hand side is the known value of yield of real source oaVb, the 
left hand side is the yield of a virtual sub-source from real source UbUb- 

Our first major task is to deduce sn from the known values, i.e., to formulate sn, the 
yield of state |1)(1| <S> in capital-letter symbols {Sap}. We shall use the following 

convex proposition to do the calculation. 

Denote S to be the yield of a certain source of state Q. If Q has the convex forms of 
^ = CapQap, we have 

S = ^c Q/3 s a/3 . (6) 

This equation is simply the fact that the total number of successful events caused by pulses 
from a certain set is equal to the summation of the numbers of successful events caused by 
pulses from each sub-sets. 

Consider the convex forms of source xaXb and source UaUb- Explicitly, 

tt XAXB = c fi + ai&iPi ® pi + a x c B p\ ® p' c + hcApc ® Pi + c A c B pc ® p' c (7) 

where c fi = Oo^o.x + &o^x,o - a 6 ^o,o)' c A p c = (Y,k>2 a k\ k )( k \) ® (Efc> 2 h\k)(k\) and 
°bP' c = {J2k>2 b k\k}(k\) <g) (J2k>2^k\k)(k\). According to Eq.flSD, this leads to 

S XA x B = S + ai6isi,i + aic B si iC + bic A s c ,i + c a cbs cc (8) 

and 

Sq = aoS OAXB + boS XAOB — aoboS OAOB . (9) 
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We also have 



^vavb = c o^o + a [b'iPi <£> Pi + a'iCgpi <g> p^,' + b[c A p c > <g> p x + d A c B p c > <g> p' c , (10) 

where c f2 (a fto l2/B + &o = fi ^,o - a &o^o,o), cVc = (E*>2°fc I ® (E fc > 2 and 

c bPc = 0>2k>2bk\k}(k\) ® (Sfe>2^l^)(^l)- According to these, we have 

a' 6' 
c aPc = —caPc + d A Pd] c b p'c = ~T c bPc + d B pd (11) 

and > 0; > 0. Here we have used the condition of Eq.(j2]). 

Svavb = S'o + a 'i fo/ i s i,i + a 'i c B s i,c' + + <t A d B s<j %( i (12) 

= 5o + a'^si,! + ^aicBSi jC + — b x c A s c ± + ^-c a cbS c ,c + £ (13) 

t>2 0-2 02(32 

where 

S = a S OA y B + b Sy AOB — o-o&o'S'oaob (14) 

and £ > 0. For any sources used in the protocol, we must have either ^f|r > |r^. or 
fffr > fffr- Suppose the former one holds, the simultaneous Eqs.flSH2D give rise to 

a ib' 2 (Sx A x B - S ) - aib2(S yA y B - S' ) , . 

a^a'Mh - b 2 b[) 1 J 

where S'0 and are defined by Eq.Q and Eq. (ll4p . respectively. This is our major formula 
for the decoy-state method implementation for MDIQKD. Note that, this formula always 
holds for whatever source that satisfies the condition in Eq. ([2~]) . Physical sources such as 
the coherent light, the heralded source by the parametric down conversion all meet the 
condition. We thus arrive at the major conclusion of this section: 

In the protocol, there are two different basis. We denote sf x and sf t for yields of single- 
photon pulse pairs in Z basis and X basis, respectively. Consider those post-selected bits 
caused by source DaUb in Z basis. After error test, we know the bit-flip error rate of this 
set, say Ey Byg . We also need the phase-flip rate for the sub-set of bits which are caused by 
the two-single-photon pulses, say E^, which is equal to the flip rate of post selected bits 
caused by single-photon in X basis, say E\\. 



{^x A x B ~ Eq)(S^ a Xr - 



7 



Here E*g is the error rate for those post selected bits in X basis, caused by pulses from 
source a(3; is the yield of source a(3 in X basis; E = a$E* B + boE XAOg — a boE OAOB 
and S£ = a S* AXB + b Q S* A0B - a b S OAOB . If p XA = p XB and p yA = p yg , we simply all b 
above by do- Given this, we can now calculate the key rate by the well known formula. For 
example, for those post selected bits caused by source VaUb, it is 

R = ^4(1 - H(E%)) - fS yAyB H{E z yByB ) (17) 

where / is the efficiency factor of the error correction method used. 

Now we discuss the value of 4 as used in Eq. (fT6|) . If we implement the decoy-state 
method for different bases separately, we can calculate 4i and 4 separately and 4 is 
known. 

We can also choose to implement the decoy-state method only in Z basis. This is to say, 
in X basis, we don't have state p yAyB , we only have state p XA x B - All pulses of state p yBVB 
will be only prepared in Z basis. The advantage of this is to reduce the basis mismatch 
so as to raise the key rate. The value of sn for X— basis pulses can be deduced from that 
for Z— basis. Suppose at each side, horizontal polarization and vertical polarization have 
equal probability to be chosen. For all those single-photon pairs in Z basis, the state in 
polarization space is 

\ (n™ + nxr + k v + nrn = \i m 

where fi-Q = \P){P\ ® \Q)(Q\, P,Q indicate the polarization which can be either H or V. 
On the other hand, for all those two-single-photon pulse pairs prepared in X basis, if the 
7r/4 and 37r/4 polarizations are chosen with equal probability, one can easily find that the 
density matrix for these single-photon pairs is also 1/4. Therefore we conclude 

4 = 4- (19) 



III. SECURITY WITH BASIS-DEPENDENT CODING ERRORS 

In practice, there are many imperfections for the real set-ups. For example, that Eqs. fl3|5|) 
only hold asymptotically. In practice, the number of pulses is finite hence these equations 
do not hold exactly due to the statistical fluctuation. Say, s and s', s a> p and can be a 
bit different. Denote s a p and s' a/3 for the yields of pulses of states p a <S> pp from two different 
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sources. In general we have 

s a p = s' a p{l + 8 a p) (20) 

where b~ a p is the statistical fluctuation whose value is among a certain range with a proba- 
bility exponentially close to 1. The range can be calculated given the number of pulses of 
each sub-sources. We can then seek the worst-case result among the range of 5 a p. Another 
imperfection is the intensity fluctuations. This can also be solved by the way given in[? ]. 

Here we consider the state-dependent coding errors, as studied in[l9|. 

For clarity, we first consider the normal QKD protocol where Alice sends pulses and Bob 
receives and detects them. 

The main idea is the to decompose a density operator into convex form and the concept 
of virtual sub-sources. The result is enhanced by combining additional real operation of 
imperfect phase randomizing. 



A. Density operator decomposition, virtual sub-sources, and basis-dependent er- 
ror for the normal QKD protocol. 

We consider the single-photon pulses only. Say, at a certain time j, Alice wants to 
prepare state \0jw) or \ljw) i n basis W (W can be Z or X) according to her bit value or 
1, she actually prepares |0^) = cos9 j W \0 jW ) + sm9 j W e l5o ^ w | or = cos 9i jW | l jW ) + 

sin 

9i jW e i5ljW - We name this subscribed 6 as error angle. At different times of i, the 
subscribed values of parameters 9 and 5 can be different at different and can be correlated. 
We set the threshold angles 9z and 9x as 

Mex{\9 QjZ \, \9 ljZ \} < 9 Z , Max{\0 OjX \, \9ijx\} < Ox (21) 

of course all {|^ojw| ; I srn must be rather small, otherwise no secure final key can be 

generated. Actually, as shall be shown latter, our theory also apply to the case that most 
of these 9 angles are very small but occasionally the values can be large. In such a case, we 
only need to reset the threshold angles as larger than most of {l^/wl, l^ijwl} so that the 
threshold values can be still rather small. For this moment we use Eq. (1211) . Also, we omit 
the subscript j if it does not cause any confusion. We consider the modified protocol as the 
following: 

According to her prepared bit value (b = or 1) in W basis, in stead of preparing state |0^?) 
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(or she takes a probability 1 — pw to prepare a state |0^*) and a small probability 

p z to intentionally prepare a wrong state 

Therefore, the density matrix of a pulse corresponding to bit values or 1 in Z basis is 

pf = (1 -p,)|0f >(0f | +p 2 |l| c *)(l| ct | (22) 

or 

pf = (1 -p 2 )|lf ><lf | +p z \0? )(0f |, (23) 

respectively. It is easy to show that, by choosing an appropriate value p z , there exists 
positive value A z so that the density matrices of pf and pf can be written in the convex 
forms of 

pf = A Z \0 Z )(0 Z \ + (1 - A z )p z0tres . (24) 

and 

pf = A z \l z )(l z \ + (1-A z )\p zhres . (25) 

Here, A z can be rather close to 1 if 6 Z is small. For example, by setting p z = |tan# 2 |, we 
can take 

A z = cos 2 ^(l - 2tan0 2 ) (26) 

for the above convex forms. Similarly, we find those states for bits or 1 in X basis can 
also be decomposed to convex forms of 

p* = A x \0 X )(0x\ + (1 " A x ) Px0 ,res, Pi = A x \l X )(l X \ + (1 - ^x)Pxl,res (27) 

and we can take 

A x = cos 2 ^(l - 2tan^) (28) 

by setting 

p x = tan6 x . (29) 

For a pulse sent at any time by Alice, the state can be one of {pf , pf , pjf , pf }, depends on the 
bit value and the basis she has chosen for that pulse. However, given the convex forms above, 
we can now assume different virtual sources. For state pf , we assume two virtual sources, 
source Zq which produces state |0^)(0^| only; source z' which produces state p z o,res only. 
Say, whenever Alice decides to send out pf , we assume she uses source z with probability 
A z or uses source z' Q with probability 1 — A z . Similarly, we have virtual source z\ which 
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only produces state |lz)(lz| and virtual source z[ which only produces state p z i,res- When 
Alice decides to send a state corresponding bit 1 in Z basis, we can equivalently assume 
that she uses source Zi or source z[ with probabilities of A z and 1 — A z . In the same idea, 
we also assume virtual sub-sources £&, x' b which only produces state \bx){bx\ or Pxb,res, with 
probabilities of A x and 1 — A x , and b = 0, 1. If we only use those bits caused by pulses 
from virtual sub-sources Zb, x&, it is just an ideal QKD protocol without any coding error and 
hence the standard results apply directly. We call these virtual sub-sources ideal sub-sources 
because they produce ideal states as requested by standard BB84 protocol. Also, we name 
virtual sub-sources w' b as tagged sub-source since we assume the worst case that Eve can 
know bit values corresponding to a pulse from any tagged sub-source. (Here w can be x or 
y and b can be or 1). Since these sub-sources are virtual, we don't know which pulses are 
from them. Therefore we need to estimate faithfully the phase-flip rate and bit-flip rate for 
bits from the ideal sources. Define virtual source z = z + z\ and ideal source x = x + X\. 
These mean that virtual source z (or x) includes all pulses from ideal BB84 sub-sources in Z 
(or X) basis. We also regard the two tagged sub-sources subscribed by w as one composite 
tagged source w'. To estimate the upper bound of error rate of post selected bits caused by 
pulses from source x, we need the lower bound of fraction of bits caused by virtual source x 
among all post-selected bits in basis X. Note that the density matrix for source x is simply 
1/2, it can have the convex form of 

1 



duh 



I c -d\ 
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I/2 = -(p + p 



for any p, here p dul is defined as p dul 

individual time % Alice sends out an X— basis single-photon pulse, a raw bit is generated 
at Bob's side. That bit could be due to virtual source x which emits density operator 1/2 
only, could be due to tagged source x' which emits density operator p = Px0,res ^" P3:1, '' es only. 
Consider the convex form for the state of Eq. (1301) . we can decompose virtual source x into 
x = x p + x p dui, where x p only produces p and source oc n dui only produces p dul . Hence, if 
the zth pulse is prepared in X basis, the pulse could be from one of the 3 virtual source 
with probabilities A x /2, A x /2 and 1 — A^. We study the relative yield of pulses 
from the ideal source in x basis by the idea used in Ref. [10] . If the zth pulse has caused a 
bit, the bit could be caused by any of the 3 virtual sources above. If it was caused by source 
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x p dui, with 100% probability it was contributed by source x; if it is not caused by source 
x p dui, it must be caused by source x p with probability fzx^+k I2 • Asymptotically, among 
all those post selected bits of basis W caused by single-photon pulses, the fraction of bits 
caused by source w is 

A > Aw = cos 2 9 W {1 - 2tanfl u; ) ^ 
2 — A w (sin 6 W + cos 9 W ) 2 
Suppose the error rate for all X— basis bits caused by single-photon pulses is Ef . Then the 
error rate for bits caused by pulses from source x and the phase flip rate of Z-basis bits 
caused by pulses from source z is 



Et ph = E* = (32) 



If we use the decoy state method, we have the key rate formula 

R = A Z A[(1 - - f H {E) (33) 

and A x , A z are given by Eqs. f )31[) . E is the detected error rate of Z-basis bits and A[ is the 
fraction of single-photon pulses bits in Z basis as post selected. 

In the protocol, we request Alice take random flip of her qubits with a small probability. 
However, these flipping operations are actually not necessary physically. In stead of flipping 
he qubits physically, she can choose to randomly choosing to flip her classical bit values with 
the same small probability. Same with the case of flipping her qubits physically, this will 
cause a rise in the error rate. The rise of the bit flip part does not decrease the final key rate 
because she knows which bits have been flipped. The rise of the phase flip part is the major 
factor that causes the final key dropping. Besides this, there are also factors such as in 
the key rate formula and 1/A X in estimating the phase error. These also decrease the key 
rate, but the amount decreased is almost negligible compared with the factor of phase flip 
rise. However, all these does not requests a very accurate source coding. Obviously, one can 
obtain final key given the largest source error (i.e., sin 2 # z )in the magnitude order of 10~ 4 . 
This has already loosened the demand in the source accuracy, compared with the existing 
result which requests a magnitude order of 10~ 7 — 10~ 6 . However, as shall be shown later 
in our work that we can further loosen the accuracy to 10 -2 — 10 _1 for the magnitude order 
of largest error, by adding phase randomizing operation. 

In the study above, we have have set 6 W > {\0ojw\, \@ijw\} f° r all j, i.e., error angles at 
all individual times must by smaller than the threshold angle. We can also treat the case 
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most of |0(yw|j \9ijw\ n °t larger than 9 W but a small fraction g w of them larger than it. In 
this case, we only need to reset A z , A x in the key rate formula Eq. (j3"3"]) by: 

A. — ► l —^A w (34) 
B. Enhanced results with phase randomizing 

We can add real physical operations to the protocol in order to further increase the effi- 
ciency In stead of random flipping to bit values, we can choose to take a phase randomizing 
operation to decompose the states into convex form. Suppose we use the photon polariza- 
tion space. To each qubits in Z basis, with half a probability we take an additional unitary 
operation of (\H) — > \H), \V) — > — |V)); to each qubit in X basis, with half a probability 
we take an additional unitary operation of (|+) — > |+), |— ) — > — \— )). If we can real- 
ize such an operation without perfectly, we can obtain convex forms for density operators 
corresponding to each bit values in each bases and we can directly use the ideal of virtual 
sub-sources to solve the problem. For example, for those pulses corresponding to bit values 
and lin Z basis, we have 

pi = cos 2 9 z0 \0 z )(0 z \+sm 2 9 z0 \l z )(l z \ = cos 2 9 Z \0 Z ) (0 Z | + sin 2 6 zPz0>res (35) 

and 

pf = cos 2 6> 2 i|l z )(l z | + sin 2 6» 2 i|l z )(l z | = cos 2 9 Z \1 Z )(1 Z \ + sin 2 9 z p zl:res (36) 

We can regard that there are sub-sources of z which only emits state \0 Z ) and sub-source 
z\ which only emits state |lz)- Each sub-source will be used with a constant probability 
cos 2 9 z /2. Density operators for those qubits in X basis can also be decomposed in 

Pq = cos 2 9 x \0 x )(+\ + sin 2 9 x p x0tres (37) 

and 

pf = cos 2 9 X \1 Z )(1 Z \ + sin 2 9 x p xhres (38) 

We can regard that there are sub-sources of xq which only emits state |0x) and sub-source 
x\ which only emits state Each sub-source will be used with a constant probability 

cos 2 # x /2. Therefore pulses from the 4 sub-sources above form the ideal BB84 states. We 
can use Eq. fl33|) for the key rate, but the value is not over estimate at all, and factors 
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of Aw = cos 2 9w, which is almost 1 if 9w is small. In this way, the tolerable largest coding 
error is in the magnitude order of 1/10, if the phase randomization can be realized. What is 
most interesting is that we can obtain almost the same good result even though the phase 
randomization is a little bit imperfect, through applying results in the earlier subsection. 

In an imperfect phase randomization, to each qubit in X basis, with half a probability 
we take an additional unitary operation of (\0x) — > \®x), |lx) — >* — e~ l&2 \+)). Here 
82 are errors in the operations, it can be different from time to time, and can be correlated 
at different times. We assume the largest values for |<5 2 | is 8 X . We can also choose to do 
phase randomization for qubts in Z-basis, but this is not necessary since the major factor in 
efficiency is in tightness of phase flip rate estimation. Technically, if the phase operation is 
done in only one basis, the rotation between the two basis states is negligible. Therefore we 
can use the above diagonal form above in X-basis for an imperfect phase operation. By the 
current matured technology, value 8 X can be controlled below 1/20. With these, we obtain 
the density matrices of qubits in X basis. For a qubit of bit value in X basis, 

x I cos 2 9 x0 sin 29 x0 (2 sin 2 8\ — i sin£)/4 \ 

Po = I J \ ) 

\ sin 26x0 (2 sin 2 S x + i sin 8) /4 sin 2 9 I 

This can be directly decomposed in 

p* = A X \0 X )(0 X \ + (1 - A x ) Px0 , res (40) 

and A x = cos 2 9 X — sin 9 x sin8 x /2. Similarly, we can also decompose the density matrix for 
bit value 1 in X basis. Explicitly, 

pf = A x \l x )(lx\ + (1 - A x ) Px i tres . (41) 

Therefore, there exists two virtual ideal sub-sources which emit state |+) or state |— ) only. 
The fraction of bits caused by pulses form these two ideal sub-sources among all post-selected 
X bits is 

^ A x 2 cos 2 9 ] x - sm6 x sav5 x / 

x ~ 2 - A x ~ 4 - 2 cos 2 9 X + sin 9 X sin S x ^ ' 

We don't need to take phase operation to qubits in Z basis. We just take random flipping 

to the bit values of Z basis with a small probability as discussed in the earlier section. We 

shall still use the key rate formula of Eq.( l33l) . but the key rate is greatly improved now, 

because here the phase flip rate is over estimated only by a negligible amount, i.e., a factor 

of l/A AX given by Eq.(g2]). 
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C. MDIQKD with source coding errors. 



Here we need to convert our results to the case of two-pulse sources. In this case, both 
Alice and Bob will send their pulses to the un-trusted third party (UTB), as has been shown. 
Neither Alice nor Bob can prepare the coding state exactly. When anyone of them wants to 
prepare a state \bw, she (he) can only prepare a state \byy) = cos9b\v\bw) +e tSbW sin 8 bw\b~w) 
and b = 0,1, bw = 1 © byy. Most generally, Alice and Bob have different threshold angles, 
noted as 8a z , 8a x for Alice in Z or X basis; and 8b z ,8bx for Bob in Z or X basis. 

In our protocol, we request Bob (Alice) to take a probability p Bw (pAw) to prepare a state 
\bjy) an d probability 1 — p Bw (or 1 — Pa w ) to prepare \b^), if the data of bit value indicates 
that he (she) should prepare a state \bw), m basis W (i.e., Z or X). By analysis similar to 
the subsection above, we can also present the appropriate convex forms and find the ideal 
sub-sources for Alice and Bob separately, in both bases. Suppose 8a w , 8b w are threshold 
angles in basis W for Alice and Bob, respectively. We can set p lw = t&n8 JW (7 = A, B). 
Then the density operators at Alice's side and the one at Bob's side can be decomposed in 
convex forms similar to equation (I22|l23p . We have the decomposition form 

P° W = A aw \bw){bw\ + (1 ~ A aw )p a bW,res- (43) 

for a state corresponding to bit value b in basis at side a = A or B. In our notation, 
as a subscript of A, the lower case w can be x or z if the basis W takes X or Z. Here 
A aw = cos 2 ^ a ,i,(l — 2 tan #„„,). Both Alice and Bob have virtual ideal sub-sources which 
emit standard BB84 states. Therefore, a single-photon pair corresponding to bit value a 
and b at Alice's side and Bob's side in basis W correspond to a two-pulse state 

pt W ® PT = Al 2 V>H ® \b)(b\ + (1 - A£W,- (44) 

and 

= A Aw A Bw (45) 

where A 7 „, is given by Eqs . (12611281) with z or x replaced by 'yw there. We define virtual 
two-pulse ideal sub-sources {W 7 ^}, a,b can be or 1. If at a certain time states of both 
single-photon pulses are from idea virtual sub-sources and are corresponding to bit values a, b 
in basis W, we say the pulse-pair is from source W a b, which is a two-pulse ideal virtual sub- 
source. If at a certain time the pulses from two sides are in the same basis W but not from 
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any of the above virtual ideal sub-sources, we regard them as tagged states from source the 
tagged source which produce states p' Wres only. Therefore, we can regard all single-photon 
pairs in Z basis as coming form 5 different virtual sources: Z 0Q , Zu, Z 01 , Z w and Z' res , which 
only emits two-pulse state |0^0^), (O^l^), \ lz®z) and state p'z.res = \^a,bPabw,res- We 

can also regard the first 4 sources as one composite source, Z which emits single-photon - 
pair state of density matrix 1/2 in 4 x 4 space only. We can then regard any single-photon 
pair in Z basis comes out from source Z with a probability Ai 2 '*, or from source Z' res with 

(2) ~ 

a probability 1 — A z . We can find that the fraction of bits caused by source W among all 
those post selected bits in W basis caused by single-photon pairs as 

A {2) 

A, = (46) 

Observing the error rate of X— basis pairs from the decoy-source, E^ AXg , we can find the 
upper bound E^, the error rate of those post-selected bits corresponding to single-photon 
pairs in X— basis by Eq.( TT6|) . and then upper bound the error rate of post selected bits 
corresponding to single-photon pairs in X— basis bits caused by virtual source X is 

£ ia < E*/A x (47) 

where E^ is the error rate for post selected bits in X basis caused by single-photon pairs, 
as given by Eq. (1161) . This is also the asymptotic phase-flip rate of bits corresponding to 
two-single-photon pulses from source Z. We can then use the key rate formula of Eq. (|33T). 
with A x and phase-flip rate given above. Finally, we have the following key rate formula for 
decoy-state MDIQKD with basis dependent errors: 

R = AX^rKl - H(E nJc )) - fS yAyB H(E^) (48) 

and a' 1 ,b' 1 are parameters appeared in the signal states p yA ,p yB as given by Eq.(l), sf x is 
given by Eq. ffT5]) . E^ is the observed error rate for all post-selected bits in Z basis, S VAyB is 
the observed yield of two-pulse source UaUb as defined in Section 1. 

We must change the formula if we only implement decoy-state method in Z basis, in 
preparing X— basis bits, we only use source xaXb- We need derive the upper bound of 
E v -, the phase-flip rate of bits corresponding to single-photon pairs from source Z, which 
is equal to E xx ^. Note that now in general, ^ sf l5 since the polarization states for Z 
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basis and X basis are different. But the yields from the ideal sources X and Z must be 
equal. We have 

> AM (49) 



which immediately leads to 



and E*, is given by Eq. (|T6l) . With this, the key rate can be calculated by Eq. (l4"gj) . 
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